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ABSTRACT 

Issues concerning the confidentiality of 
library-patron records in the age of electronics are explored. 
Confidentiality of patron records is a relatively new concept for 
libraries and was first Introduced in the 1938 Code of Ethics of the 
American Library Association (ALA) . Librarians have worked on a 
state-by-state basis to protect library records frofl public 
disclosure. The advent of sophisticated technology means that a 
common patron-record format is a necessary component in the 
development of multisystem library networks. Currently, the National 
Information Standards Organization, NISO, has drafted a standard 
format for patron records. Library clerical staff now have access to 
a great deal of personal information about individuals who come to 
check out books. Libraries compile and maintain records as a 
necessary part of doing business. Some of that data is sensitive. So 
far, libraries have been relatively successful in protecting 
circulation records from government agencies and private individuals, 
but they are beginning to find that it is all too easy to collect and 
share personal information in an automated system. (SLD) 
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Confidentiality of patron records is a relatively new concept for 
libraries. For example, librarians in Benedictine monasteries disclosed 
circulation information regularly. Under the rule of St. Benedict, 
monks were assigned texts to study. At Lent, the librarian read aloud 
the circulation records for each monk. If the monk had not studied the 
book entrusted to him, he was to confess his fault. 1 In early American 
subscription libraries, circulation information was simply recorded in 
ledgers which were open for anyone to view. 2 It was not until the last 
50 years that American librarians questioned publicly disclosing library 
records. The American Library Association first introduced the concept 
in the 1938 Code of Ethics revision with text reading: 

... it is the librarian's obligation to treat as confidential any 
private information obtained through contact with library 
patrons. 3 

The language in the current Code is equally broad. In part it reads: 



1 Bruce M. Kennedy, "Confidentiality of Library Records: A Survey of Problems, 
Policies, and Laws," Law Library journal 84 (Fall 1989): 733. 

2 Michael H. Harris, History of Libraries in the Western World. Compact Textbook 
Edition. Scarecrow Press, Inc. 1984, p.173. 

3 "Code of Ethics For Librarians" American Library Association Bulletin 33 (February 
1939): 129. 



Librarians must protect each user's right to privacy with 
respect to information sought or received, and materials 
consulted, borrowed, or acquired. 4 

In addition, the American Library Association's Intellectual Freedom 
Committee has issued guidelines in 1990 for library administrators 
titled Confidentiality and Coping with Law Enforcement Inquiries. 
This document specifies that: 

Confidential records should not be made available to anv 
agency of state, federal or local government or any other 
person (outside the minimum necessary access by library 
staff), unless a court order requiring disclosure has been 
entered by a court of competent jurisdiction, after a 
showing of good cause by the person or agency requesting 
the records. 5 

But compliance with the Code of Ethics is voluntary and, more 
importantly, the ALA code carries no consequence. Violation does not 
result in professional sanctions or fines. 



Moreover, in some states, existing laws concerning open access to 
government information conflicts with the ALA Code of Ethics. Many 
states have Open Record laws mandating that government records be 
freely available for public inspection. When challenged, state 
governments have held that library circulation records are subject to 



4 American Library Association, "On Professional Ethics," as reproduced in Anne P. 
Mintz, Information Ethics: Concerns for Librarianship and the Information Industry, 
Jefferson, N.C; McFarland, 1990, p. 62. 

5 American Library Association Intellectual Freedom Committee, "Confidentiality and 
Coping with Law Enforcement Inquiries— Guidelines for the Library Administrator," as 
reproduced in Anne P. Mintz, Information Ethics: Concerns for Librarianship and the 
Information Industry, Jefferson, N.C; McFarland, 1990, p. 75. 
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Open Records laws. As a consequence, librarians worked on a state by 
state basis to pass statues protecting library records from public 
disclosure. Currently about 30 states have such legislation. 6 There is 
good reason to seek legislation to protect circulation records. There are 
hundreds of documented demands for circulation records from 
individuals and the government. Some have come from sales 
representatives wanting to develop customer lists. In one case a 
husband wanted to know if his wife had borrowed books about divorce 
and in another a parent wanted to know if his child had charged out 
books on homosexuality. Those seeking to ban controversial literature 
have often demanded to know who has borrowed those books. The 
FBI has solicited circulation records to identify potential enemies of the 
government. And there are several instances of police departments 
trying to obtain circulation records of "subversive" literature that they 
believe will identify potential criminals. 7 

Colorado's statute, passed in 1983, typifies the history such legislation. 
In March of 1981 John Hinckley attempted to assassinate President 
Reagan. One of the few items in his wallet was a Jefferson County 
Colorado Public Library card. The press inundated the library with 
requests for Hinckley's circulation information. The circulation 



6 Some of these states ate: Alaska, Arizona, California, Colorado, Connecticut, District 
of Columbia, Idaho, Indiana, Illinois, Louisiana, Maine, Massachusetts, Nevada, New 
Hampshire, New jersey, New York, North Dakota, Oklahoma, Oregon, South 
Carolina, South Dakota, Texas, Vermont, Virginia, Washington, Wisconsin, Wyoming. 
The text of many of these statutes has been compiled in Alan Jay Lincoln, "State 
Statutes on Confidentiality of Information," Library & Archival Security 11 (2): 49-77. 

7 Kennedy, p. 737-738. 



librarian, acting upon the ALA Code of Ethics, refused to disclose the 
information. But the county attorney held that circulation records 
were subject to Colorado's open records law and ordered that they to be 
disclosed. 8 As a result of that incident, a statute was passed in 1990 that 
says, in part, that "a publicly-supported library or library system shall 
not disclose any record or other information which identifies a person 
as having requested or obtained specific materials or service or as 
otherwise having used the library/ 7 Colorado's law is unique in 
specifying a $300 maximum fine for disclosing such information. 9 

Into this rather complicated legal situation has come some 
sophisticated technology. And, as seems to be the case when expensive 
technology is introduced, things are now even more complicated. 
What kind of records are stored in an online circulation system? 
While the details on how circulation systems work varies from library 
to library, each system contains three large files: a database of item 
records, a database of patron records, and a database of transaction 



8 Anne Marie Falsone, "Privacy of Circulation Files/' journal of Library Administration 

7( Winter 1986): 19. 

^ The complete statute reads: 

24-90-119. Privacy of user recot 

(1) Except as set forth in subsection (2) of this section, a publicly- 
supported library or library system shall not disclose any record or other 
information which identifies a person as having requested or obtained 
specific materials or service or as otherwise having used the library. 

(2) Records may be disclosed in the following instances: 

(a) When necessary for the reasonable operation of the library; 

(b) Upon written consent of the user; 

(c) Pursuant to subpoena, upon court order, or where otherwise 
required by law. 

(3) Any library or library system official, employee, or volunteer who 
disclosed information in violation of this section commits a class 2 petty 
offense and, upon conviction thereof, shall be punished by a fine of not more 
than three hundred dollars. 

Source: L. 83, p. 1023, 1. 
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records. Item records contain brief descriptions of a specific book. 
There are fields for author, title, bar code number, call number, and so 
on. Patron records contain name /address information of borrowers. 
There are fields for ID numbers, addresses, and so on. Transaction 
records result from the merger of item and patron records. The 
transaction record contains information about the borrower, the book, 
when it is due, when it was loaned, and so on. Two of these — the 
transaction and patron files — present confidentiality problems. 

The transaction data most libraries maintain is relatively simple. 
Included in each record is a patron name, a list of titles currently 
charged out, the date and place charged, any information concerning 
when it was renewed, the date due, and if overdue, the fines charged 
against each item. Once a book is discharged from a patron's account, 
the link between the patron and item is erased and not maintained. 
Very few circulation systems maintain a history of what a user has 
checked-out. 

Libraries maintain surprisingly detailed personal data about their 
patrons. This is because name /address information is very important. 
Once a book is loaned, the name/ address information is the only link 
to that item. At an absolute minimum, libraries will maintain a name, 
social security number, 2 addresses, 2 telephone numbers, usually 
home and work, concerning patrons. The character of information 
collected is different between academic and public libraries. Each have 



different constituencies and as a consequence the kind of information 
collected is different. For example, college students change addresses 
frequently so academic libraries regularly store their parents address. 
And public libraries are likely to collect information on any dependents 
a patron might have. 

Currently, the National Information Standards Organization, NISO, 
which defines standards for libraries and the publishing industry has 
drafted a standard format for patron records. 10 The intent is that all 
library circulation systems — public, academic, and special — :vill use 
this common format. Standard formats offer libraries certain 
processing advantages but more importantly, a common patron record 
format is a necessary component towards development of multi- 
system library networks. 

Because a single record is to serve academic, public, and special 
libraries, the proposed record includes all fields needed by every library. 
As a consequence, the record contains 15 major divisions, 51 fields, and 
109 subfields. This is a very large record. There is room for more than 
just a name and an address. In fact, there are several dozen elements, 
including space for: 

passport and visa numbers, 
military ID number, 
social security number, 



10 National Information Standards Organization, "Proposed American National 
Standard Patron Record Data Elements, ANSI/NISO Z39.69-199X" (National 
Information Standards Organization, 1992), p. 8-13. 
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driver's license number, 

employer address, 

job title, 

email address, 

fax numbers, and even 

native language. 

There are legitimate reasons why such information is needed. And 
not all libraries will carry such detailed information about their 
patrons. But as anyone who has managed a large database can attest, if 
there is a field being carried in the record information is put into it 
whether or not it is relevant to the organizational needs. 

One rec\son for this is that information is so easy to get. Such data is 
rarely hand entered, instead it is automatically loaded into the library 
computer from other computers. For example, in an academic library 
setting, a patron database draws from the University payroll database 
for faculty /staff information and from the Registrar's database for 
student data. Any information those systems carry can be 
automatically downloaded into the library's database. 

Another reason for carrying such detail is the hope that it will lead to 
better management decisions. Like most sophisticated computer 
software, library circulation systems have powerful reporting 
capabilities. Presumably, the more robust the individual records, the 
more ways that information can be sorted for management 
information. For example, it is possible to discover the times different 
classes of patrons use the library, what portions of the collection are 




most heavily used, or the patterns of book losses by different factors. 
This information can be used to adjust staffing at service desks, 
prioritize shelving, and target specific groups of patrons for instruction. 
The budgetary restraints libraries operate under often compels library 
managers to search for these kinds of patterns to save money. 

With managers choosing to carry more data about patrons, library 
clerical staff now have access to a great deal of personal information 
about individuals when they come to the circulation desk to check out 
books. This is not particularly dangerous if there is a reasonable 
number of staff in which to communicate confidentiality issues. But 
the more people involved, the more difficult it becomes to maintain 
security. 

The new generation of library computer systems promises to 
complicate this immensely. The idea is to connect libraries in the same 
region or state with a common network. All the libraries in the 
network share the same online catalog, the same circulation system, 
and the same cataloging system. For example, in Ohio, a patron who 
searches the online catalog at Ohio State sees the holdings of Cleveland 
State, University of Cincinnati, Case Western Reserve, Wright State, 
University of Akron, Cleveland Public Library, the State Library of 
Ohio — eventually the network will have eighteen major libraries in 
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the state comprising an online catalog of about thirteen million 
items. 11 

Patrons can search the catalog, identify a book they need, issue a 
keyboard command, and have it delivered to their most convenient 
branch or their campus office. Similarly, they can search databases of 
articles and, upon command, have the article faxed directly to them. 
Requests that took interlibrary loan six weeks to fill now come in about 
three days. A patron can walk into a network library in another city 
and immediately borrow books. Moreover, they can return those 
books at their local branch to be returned by courier. As you might 
expect these services — and these are only a few examples — have 
become very popular with Ohio's library users. 

But for this system to work, each library in the network needs full 
access to every other library's patron files. If you are in Dayton and an 
Akron patron wishes to borrow a book, you have to verify that they are 
eligible and have a record on which to attach the transaction. So with 
these systems, libraries are beginning to transfer sensitive data to 
hundreds of terminals across the state. Therefore, a clerk in Cleveland 
can now tell what patrons have checked out — whether the items 
checked it out in Cleveland, Columbus, or Cincinnati. 



11 David F. Kohl, "OhioLINK: Plugging Into Progress/' Library journal 118 (16): 43. 
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Maryland also has such a system installed and Michigan and Illinois 
have plans to bring up such systems within the next three years. 
Already, there is discussion about connecting some of these networks 
to create a multi-state library network. It is not unforseeable, then, that 
a University of Michigan faculty member will be able to request 
materials from Ohio State's Chemistry library as easily as materials 
from a library up the street. But would that same facility member be 
comfortable knowing that a clerk in OSU's Chemistry building has 
access to the titles of books checked out as well as considerable personal 
information? 

Libraries compile and maintain records as a necessary part of doing 
business. Some of that data is sensitive. And while government 
agencies and private individuals periodically attempt to seize 
information, to date, libraries have been relatively successful in 
protecting circulation records. But like so many other institutions that 
have become computer-dependent, libraries are finding that it is all too 
easy to collect and share personal information in an automated system. 
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